Build and publish multi-architecture images

.github/workflows/ci.yml

@@ -118,6 +118,12 @@ jobs:
             CHANGED_SERVICES=$(echo "$CHANGED_SERVICES" | jq -c ". + [\"bench-worker\"]")
           fi
 
+          # Build workflow changes on every service so Docker/build tooling
+          # changes are validated against every image on both architectures.
+          if git diff --name-only "$BASE" "$HEAD" 2>/dev/null | grep -qE '^\.github/workflows/|^s/ci/build\.sh$'; then
+            CHANGED_SERVICES='["server","bot","ai","sockets","scheduler","bench-api","bench-sandbox","bench-worker"]'
+          fi
+
           echo "services=$CHANGED_SERVICES" >> $GITHUB_OUTPUT
           echo "Changed services: $CHANGED_SERVICES"
 
@@ -301,11 +307,18 @@ jobs:
     name: Build Docker Images
     needs: detect-changes
     if: needs.detect-changes.outputs.services != '[]'
-    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         service: ${{ fromJson(needs.detect-changes.outputs.services) }}
+        architecture:
+          - name: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+          - name: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.architecture.runner }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -330,7 +343,8 @@ jobs:
         with:
           context: ${{ steps.ctx.outputs.context }}
           file: ${{ steps.ctx.outputs.file }}
+          platforms: ${{ matrix.architecture.platform }}
           push: false
-          tags: swecc-${{ matrix.service }}:test
+          tags: swecc-${{ matrix.service }}:test-${{ matrix.architecture.name }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/deploy-ai.yml

@@ -7,8 +7,6 @@ on:
       - 'services/ai/**'
       - 's/ops/**'
       - 's/lib.sh'
-      - '.github/workflows/deploy-ai.yml'
-      - '.github/workflows/reusable-deploy.yml'
   workflow_dispatch:
 
 jobs:

.github/workflows/deploy-bench-api.yml

@@ -12,8 +12,6 @@ on:
       - 'services/server/server/bench/**'
       - 's/ops/**'
       - 's/lib.sh'
-      - '.github/workflows/deploy-bench-api.yml'
-      - '.github/workflows/reusable-deploy.yml'
   workflow_dispatch:
     inputs:
       redeploy_from_scratch:

.github/workflows/deploy-bench-sandbox.yml

@@ -8,8 +8,6 @@ on:
       - 'services/bench/common/**'
       - 's/ops/**'
       - 's/lib.sh'
-      - '.github/workflows/deploy-bench-sandbox.yml'
-      - '.github/workflows/reusable-deploy.yml'
   workflow_dispatch:
 
 jobs:

.github/workflows/deploy-bench-worker.yml

@@ -8,8 +8,6 @@ on:
       - 'services/server/server/bench/**'
       - 's/ops/**'
       - 's/lib.sh'
-      - '.github/workflows/deploy-bench-worker.yml'
-      - '.github/workflows/reusable-deploy.yml'
   workflow_dispatch:
 
 jobs:

.github/workflows/deploy-bot.yml

@@ -7,8 +7,6 @@ on:
       - 'services/bot/**'
       - 's/ops/**'
       - 's/lib.sh'
-      - '.github/workflows/deploy-bot.yml'
-      - '.github/workflows/reusable-deploy.yml'
   workflow_dispatch:
 
 jobs:

.github/workflows/deploy-rabbit.yml

@@ -5,7 +5,6 @@ on:
     branches: [main, master]
     paths:
       - 'infra/rabbit/**'
-      - '.github/workflows/deploy-rabbit.yml'
   workflow_dispatch:
 
 env:
@@ -24,13 +23,19 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Pull, tag, and push RabbitMQ image
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Publish multi-architecture RabbitMQ image
         run: |
-          docker pull rabbitmq:3-management
-          docker tag rabbitmq:3-management ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:latest
-          docker tag rabbitmq:3-management ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
-          docker push ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:latest
-          docker push ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+          # Copy the upstream manifest list so both amd64 and arm64 nodes get
+          # the matching RabbitMQ image instead of the runner's native image.
+          docker buildx imagetools create \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:latest \
+            rabbitmq:3-management
+          docker buildx imagetools create \
+            --tag ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
+            rabbitmq:3-management
 
   deploy_to_swarm:
     name: Deploy to Swarm

.github/workflows/deploy-redis.yml

@@ -5,7 +5,6 @@ on:
     branches: [main, master]
     paths:
       - 'infra/redis/**'
-      - '.github/workflows/deploy-redis.yml'
   workflow_dispatch:
 
 env:
@@ -14,9 +13,19 @@ env:
   NETWORK: prod_swecc-network
 
 jobs:
-  push_to_dockerhub:
-    name: Build and Push
-    runs-on: ubuntu-latest
+  build_and_push:
+    name: Build and Push (${{ matrix.architecture.name }})
+    strategy:
+      fail-fast: false
+      matrix:
+        architecture:
+          - name: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+          - name: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.architecture.runner }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -27,18 +36,44 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Build and push Docker image
         uses: docker/build-push-action@v5
         with:
           context: ./infra/redis
+          platforms: ${{ matrix.architecture.platform }}
           push: true
           tags: |
-            ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:latest
-            ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-${{ matrix.architecture.name }}
+
+  publish_manifest:
+    name: Publish Multi-Architecture Manifest
+    needs: build_and_push
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Publish image manifests
+        run: |
+          IMAGE="${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}"
+          docker buildx imagetools create \
+            --tag "$IMAGE:latest" \
+            --tag "$IMAGE:${{ github.sha }}" \
+            "$IMAGE:${{ github.sha }}-amd64" \
+            "$IMAGE:${{ github.sha }}-arm64"
 
   deploy_to_swarm:
     name: Deploy to Swarm
-    needs: push_to_dockerhub
+    needs: publish_manifest
     runs-on:
       group: EC2
       labels: [self-hosted, deploy]

.github/workflows/deploy-scheduler.yml

@@ -7,8 +7,6 @@ on:
       - 'services/scheduler/**'
       - 's/ops/**'
       - 's/lib.sh'
-      - '.github/workflows/deploy-scheduler.yml'
-      - '.github/workflows/reusable-deploy.yml'
   workflow_dispatch:
 
 jobs:

.github/workflows/deploy-server.yml

@@ -10,8 +10,6 @@ on:
       - '!services/server/rabbit_listener.py'
       - 's/ops/**'
       - 's/lib.sh'
-      - '.github/workflows/deploy-server.yml'
-      - '.github/workflows/reusable-deploy.yml'
   workflow_dispatch:
 
 jobs:

.github/workflows/deploy-sockets.yml

@@ -7,8 +7,6 @@ on:
       - 'services/sockets/**'
       - 's/ops/**'
       - 's/lib.sh'
-      - '.github/workflows/deploy-sockets.yml'
-      - '.github/workflows/reusable-deploy.yml'
   workflow_dispatch:
 
 jobs:

.github/workflows/reusable-deploy.yml

@@ -35,9 +35,19 @@ env:
   NETWORK: prod_swecc-network
 
 jobs:
-  push_to_dockerhub:
-    name: Build and Push
-    runs-on: ubuntu-latest
+  build_and_push:
+    name: Build and Push (${{ matrix.architecture.name }})
+    strategy:
+      fail-fast: false
+      matrix:
+        architecture:
+          - name: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+          - name: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.architecture.runner }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -48,6 +58,9 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Resolve build context
         id: ctx
         run: |
@@ -85,14 +98,37 @@ jobs:
         with:
           context: ${{ steps.ctx.outputs.context }}
           file: ${{ steps.ctx.outputs.file }}
+          platforms: ${{ matrix.architecture.platform }}
           push: true
           tags: |
-            ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE }}:latest
-            ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE }}:${{ github.sha }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE }}:${{ github.sha }}-${{ matrix.architecture.name }}
+
+  publish_manifest:
+    name: Publish Multi-Architecture Manifest
+    needs: build_and_push
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Publish image manifests
+        run: |
+          IMAGE="${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE }}"
+          docker buildx imagetools create \
+            --tag "$IMAGE:latest" \
+            --tag "$IMAGE:${{ github.sha }}" \
+            "$IMAGE:${{ github.sha }}-amd64" \
+            "$IMAGE:${{ github.sha }}-arm64"
 
   deploy_to_swarm:
     name: Deploy to Swarm
-    needs: push_to_dockerhub
+    needs: publish_manifest
     timeout-minutes: 20
     runs-on:
       group: EC2

s/ci/build.sh

@@ -7,6 +7,7 @@ REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
 PUSH=false
 TAG="latest"
 SERVICE=""
+PLATFORMS=""
 
 usage() {
   cat <<EOF
@@ -17,6 +18,8 @@ Services: ${SERVICES[*]}
 Options:
   --push        Push images to Docker Hub after building
   --tag <tag>   Tag for the image (default: latest)
+  --platforms <list>
+                Target platforms (default: host for local builds, amd64+arm64 with --push)
   -h, --help    Show this help message
 
 Examples:
@@ -48,14 +51,38 @@ build_service() {
   log INFO "Build context: $context"
   log INFO "Dockerfile: $dockerfile"
 
-  docker build -t "$image" -t "$image_sha" -f "${context}/${dockerfile}" "$context"
+  local target_platforms="$PLATFORMS"
+  if [[ -z "$target_platforms" ]]; then
+    if [[ "$PUSH" == "true" ]]; then
+      target_platforms="linux/amd64,linux/arm64"
+    else
+      target_platforms="$(docker info --format '{{.OSType}}/{{.Architecture}}')" \
+        || die "Unable to determine the local Docker platform; pass --platforms explicitly"
+    fi
+  fi
+
+  local -a build_args=(
+    buildx build
+    --platform "$target_platforms"
+    -t "$image"
+    -t "$image_sha"
+    -f "${context}/${dockerfile}"
+  )
 
   if [[ "$PUSH" == "true" ]]; then
-    log INFO "Pushing $image to Docker Hub"
-    docker push "$image"
-    docker push "$image_sha"
+    build_args+=(--push)
+  else
+    # A multi-platform image cannot be loaded into the local Docker image
+    # store.
+    if [[ "$target_platforms" == *,* ]]; then
+      die "Local multi-platform builds require --push; use --platforms linux/amd64 (or linux/arm64) for --load"
+    fi
+    build_args+=(--load)
   fi
 
+  build_args+=("${context}")
+  docker "${build_args[@]}"
+
   log INFO "Successfully built $svc"
 }
 
@@ -69,6 +96,10 @@ while [[ $# -gt 0 ]]; do
       TAG="$2"
       shift 2
       ;;
+    --platforms)
+      PLATFORMS="$2"
+      shift 2
+      ;;
     -h|--help)
       usage
       ;;